Use GSC PAP without an MCP client

Steps

1. 1

   Sign in to GSC PAP and copy your token

   Visit gscpap.com → Sign in with Google → grant Search Console + GA4 scopes → copy the bearer token from the connect page.

2. 2

   Initialize the MCP session

   POST a JSON-RPC `initialize` request. The server returns its capabilities. The same Authorization header carries your bearer on every subsequent request.

   shellCopy

   curl -X POST https://mcp.gscpap.com/mcp \
     -H "Authorization: Bearer YOUR_TOKEN_HERE" \
     -H "Content-Type: application/json" \
     -H "Accept: application/json, text/event-stream" \
     -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "initialize",
       "params": {
         "protocolVersion": "2025-06-18",
         "capabilities": {},
         "clientInfo": {"name": "curl", "version": "1.0"}
       }
     }'

3. 3

   List + call tools

   After initialize succeeds you can call `tools/list` to discover the 30 available tools, then `tools/call` to invoke any of them by name. Sample call to list_sites, replace `tools/call` payload with any other tool from the list.

   shellCopy

   curl -X POST https://mcp.gscpap.com/mcp \
     -H "Authorization: Bearer YOUR_TOKEN_HERE" \
     -H "Content-Type: application/json" \
     -H "Accept: application/json, text/event-stream" \
     -d '{
       "jsonrpc": "2.0",
       "id": 2,
       "method": "tools/call",
       "params": {
         "name": "list_sites",
         "arguments": {}
       }
     }'

Common gotchas

• ·GSC PAP runs `stateless_http: true` mode, every request is independent. You don't need to keep a session id across calls; each request just carries the bearer.
• ·Rate limits apply per-token: 30 requests/minute, 500/hour. The server returns 429 with a Retry-After header when you exceed them. Live usage at app.gscpap.com/account.
• ·For Python agents, the official `mcp` package (pip install mcp) wraps all of this for you, preferred over raw curl unless you're scripting one-off shell pipelines.
• ·Bearer tokens are logged on the client side if you use `curl -v` for debugging. Strip the Authorization line from any output you share for support.